fix: address Phase 1 code review findings

- Serve cache via template_redirect so feeds/404/REST are excluded and
  query conditionals work
- Bypass cache on query strings; key files by md5(host+path) to avoid
  collisions and support multisite
- Write wp-content/wp-recache-cache.php drop-in server and set WP_CACHE
  in wp-config.php so advanced-cache.php actually runs
- Only remove advanced-cache.php on deactivation when it is ours
- Respect DONOTCACHEPAGE, non-200 responses; bots read but never warm
  cache
- Fix comment purge (comment_post_ID) and heartbeat purge ($data arg)
- Fix exclude URLs textarea parsing; purge all when exclusions change
- Enqueue admin purge script on every admin-bar page, not just settings
- Sync tests, add TESTING.md manual test guide

includes/Cache/WPCache.php

@@ -9,17 +9,26 @@ defined('ABSPATH') || exit;
 
 class WP_Recache_WPCache {
 
+    /**
+     * Whether this request started our output buffer.
+     *
+     * @var bool
+     */
+    private $buffer_started = false;
+
     /**
      * Initialize cache hooks.
      */
     public function init() {
-        add_action('init', [$this, 'start_output_buffering']);
+        // template_redirect: query conditionals (is_feed/is_404/is_preview) are
+        // available here, and REST/AJAX requests never reach it.
+        add_action('template_redirect', [$this, 'start_output_buffering'], 0);
         add_action('shutdown', [$this, 'end_output_buffering']);
 
         add_action('save_post', [$this, 'purge_post_cache']);
-        add_action('wp_insert_comment', [$this, 'purge_post_cache']);
+        add_action('wp_insert_comment', [$this, 'purge_comment_cache']);
 
-        add_filter('heartbeat_received', [$this, 'purge_cache_onheartbeat']);
+        add_filter('heartbeat_received', [$this, 'purge_cache_onheartbeat'], 10, 2);
     }
 
     /**
@@ -54,8 +63,14 @@ class WP_Recache_WPCache {
             }
         }
 
+        // Bots get served warm cache but never warm it themselves.
+        if (wp_recache_is_robots()) {
+            return;
+        }
+
         header('X-WP-Recache: MISS');
         ob_start([$this, 'cache_output']);
+        $this->buffer_started = true;
     }
 
     /**
@@ -69,6 +84,20 @@ class WP_Recache_WPCache {
             return $output;
         }
 
+        // Respect opt-outs from WordPress and third-party plugins.
+        if (defined('DONOTCACHEPAGE') && DONOTCACHEPAGE) {
+            return $output;
+        }
+
+        $status = http_response_code();
+        if ($status !== false && $status !== 200) {
+            return $output;
+        }
+
+        if (wp_recache_is_robots()) {
+            return $output;
+        }
+
         $url = $this->get_current_url();
         $cache_path = wp_recache_get_cache_path_with_device($url);
         $cache_dir = dirname($cache_path);
@@ -86,7 +115,7 @@ class WP_Recache_WPCache {
      * End output buffering.
      */
     public function end_output_buffering() {
-        if (ob_get_level()) {
+        if ($this->buffer_started && ob_get_level()) {
             ob_end_flush();
         }
     }
@@ -106,15 +135,30 @@ class WP_Recache_WPCache {
         wp_recache_delete_cache(home_url('/'));
     }
 
+    /**
+     * Purge cache for the post a comment belongs to.
+     *
+     * @param int $comment_id Comment ID.
+     */
+    public function purge_comment_cache($comment_id) {
+        $comment = get_comment($comment_id);
+
+        if ($comment) {
+            $this->purge_post_cache($comment->comment_post_ID);
+        }
+    }
+
     /**
      * Purge cache on heartbeat.
      *
      * @param array $response Heartbeat response.
+     * @param array $data     Data sent with the heartbeat request.
      * @return array Modified response.
      */
-    public function purge_cache_onheartbeat($response) {
-        if (isset($response['wp_recache_purge'])) {
+    public function purge_cache_onheartbeat($response, $data) {
+        if (isset($data['wp_recache_purge'])) {
             wp_recache_delete_all_cache();
+            $response['wp_recache_purged'] = true;
         }
 
         return $response;
@@ -127,8 +171,8 @@ class WP_Recache_WPCache {
      */
     private function get_current_url() {
         $protocol = is_ssl() ? 'https' : 'http';
-        $host = $_SERVER['HTTP_HOST'];
-        $uri = $_SERVER['REQUEST_URI'];
+        $host = $_SERVER['HTTP_HOST'] ?? '';
+        $uri = $_SERVER['REQUEST_URI'] ?? '/';
 
         return $protocol . '://' . $host . $uri;
     }